Troubleshooting connectivity with Network Watcher: IP flow verify, next hop, connection troubleshoot, effective routes

When a virtual machine (VM) cannot reach something, the cause is usually one of three things: a network security group (NSG) rule blocks the traffic, a route sends it somewhere unexpected, or the destination itself is not listening or is unreachable. Azure Network Watcher provides tools that test each possibility from the Azure platform's point of view, without logging in to the VM. Network Watcher is enabled automatically per region when you create a virtual network, and its tools are in the portal under Network Watcher or on a VM's Help and Connection troubleshoot blades.